0

I have about 35 projects in my solution. These are:

  • Xamarin projects
  • WPF project
  • Web client
  • WebAPI

and others. So I have one big solution which makes several clients and WebAPI. Every client consumes WebApi.

Now, I want to create a project that would really be a Mail service. I thought of it as a project, because WebApi uses it and other clients also should use it. So there are two ways:

  • Create a new endpoint in WebApi for mail services -> but this one should be somehow protected
  • Create a common dll (project) for mail service. But this creates some security problem also.

For example desktop users could view my dll and see that there is a method called for example: "SendMail". And they will be able to send mails from my account.

So I thouht of a way of protecting this dll. For example - is it possible to configure it so that only projects from my solution could use it?

[edit] For now I have just found some kind of solution, but it requires the assemblies to be signed with pfx.

Then you can just:

using System.Reflection;
    
internal static void CheckForSamePublicToken() {
  byte[] current;
  byte[] entry;
    
  current = Assembly.GetExecutingAssembly().
       GetName().GetPublicKeyToken();
  entry = Assembly.GetEntryAssembly().
       GetName().GetPublicKeyToken();
    
  if(current.Length != entry.Length)
    throw new ApplicationException(
      "Can't run this DLL from this assembly.");
    
  for (int i = 0; i < current.Length - 1; i++) {
    if (current[i] != entry[i])
      throw new ApplicationException(
        "Can't run this DLL from this assembly.");
  }
}

You can read more on this blog: https://www.codemag.com/article/1011021/Licensing-and-Obfuscation

Adam Jachocki
  • 1,897
  • 1
  • 12
  • 28
  • 1
    You could make it internal and use `InternalsVisibleTo` to specify the projects (assemblies) that can use it. Whether it’s a good idea I’m not sure, but it’s possible. – sellotape Apr 14 '21 at 11:42
  • Have a look at [this question](https://stackoverflow.com/questions/1072540/winverifytrust-to-check-for-a-specific-signature) which uses a form of signing to restrict access. – pritaeas Apr 14 '21 at 11:45
  • 2
    Sorry, but you can't protect the library if it is run on client's computer. The user can simply disassemble the dll and see everything there is inside it. So if your security hinges on that, you are in trouble anyway. You could try to obfuscate the binary, there are tools for that, but I'd advise you to implement a proper user authentication. – Morse Apr 14 '21 at 12:30

0 Answers0